4 ms·

The HN login page seems highly insecure- Can any of you pros give an assessment?

13 points by drcode 14y ago

I noticed that the login page for HN doesn't have any meaningful security, with no use of SSL: http://news.ycombinator.com/newslogin?whence=news It seems it would be trivial for someone sniffing packets on the network to steal your HN password- Am I right about this? I'm not asking this because I'm a stickler for web security: Actually, I'm asking because I'm creating my own website right now and would love to get away with such a crude, easy to program login mechanism :-)

bdfh42 14y ago
No money involved here and (as you are an HN type) you will be using a unique password. Accessing HN from your own devices, then you will probably stay logged in - so not much to "sniff". Additional security would be all pain with very little gain in my opinion.
- drcode 14y ago
  That basically answers my question, assuming other HNers agree with you: For my own website I will also have nothing of real value and so there's no real danger if someone gets hacked. The only real danger is for bozos who use the same password for HN as they do for their citibank account...
  - manuscreationis 14y ago
    You really need to re-think this attitude toward security. It is absolutely your responsibility, as the developer of your application, to make security of user accounts an absolute priority. It doesn't matter what the purpose of your website is - if you're having users create accounts, you need to secure them as best as you can. It's not ok for you to classify users who have poor password practice as "Bozos". These are your users - your customers - the people who give your application a purpose. Treat them with respect, or let them find someone who will.
  - FuzzyDunlop 14y ago
    If your site has nothing of real value, then why are you requiring a login in the first place? Further to that, if someone gets 'hacked' using your service, you've already highlighted that the vulnerability was using your no value service. Don't skimp on basic security. And show your potential users a little less contempt, too. They are not the 'bozos' here.
    - drcode 14y ago
      > They are not the 'bozos' here. Does that make PG the bozo?
    - mustafa0x 14y ago
      Users who have the same password for HN and their bank are indeed bozos.
      - manuscreationis 14y ago
        That isn't the point. No one here is saying that users shouldn't have better password policies. They should. What is being said is that having a devil-may-care attitude toward safe guarding your users account data is not ok. If you use your bank password for anything other than your bank, you're clearly not taking security seriously. If you think you shouldn't have to properly secure user account information, you're clearly not taking security seriously. Both parties can be wrong, but that doesn't excuse either side.
        mustafa0x 14y ago
        It was the point drcode was making (which FuzzyDunlop misunderstood): > The only real danger is for bozos who use the same password for HN as they do for their citibank account --- Excuse my pedantry, but I'd advise against saying "That isn't the point.", for it conflicts with a well known writing technique: http://en.wikipedia.org/wiki/Show,_don%27t_tell http://en.wikipedia.org/wiki/Show,_don%27t_tell If you insist on doing so, consider a more polite alternative. E.g. "it's seems you've missed the point", "perhaps you've misunderstood", "I feel that so-and-so was saying something else".
  - bdfh42 14y ago
    Take a good look at OpenID and oAuth - that way you can offer secure sign up / login without having to manage user passwords - well unless you offer that as an additional option.
loftsy 14y ago
How about using this: http://www.mozilla.org/en-US/persona/ http://www.mozilla.org/en-US/persona/ for your easy to program login mechanism.
bradfa 14y ago
If you simply go to that login, but s/http/https/, voila! ssl! I was initially confused by your question, apparently HN is always using https for me.
- drcode 14y ago
  Well, it's definitely http by default for me, but I agree completely that a knowledgeable person would switch to https before logging in.
  - Firehed 14y ago
    And a knowledgeable developer would do that automatically. It's not a user's job to know to do this, and it's not a developer's job to train users to know this. You need security turned on by default, end of discussion. Is HN a site with sensitive information? Not particularly, unless you put way too much faith in your karma. That doesn't make a default behavior of sending passwords over plaintext excusable. And despite most HN users knowing better, I guarantee there's plenty of password re-use here (hopefully re-use of the throw-away password that most people have, but that does't make the situation any more acceptable).
- manuscreationis 14y ago
  I would imagine it should be trivial to have the application automatically switch a user over to ssl when attempting to login, as a lot of applications do this. Maybe it's PGs way of teaching people to think about security by making it something they need to "opt-in" to, but that seems like a fairly strange line in the sand to draw.
Mamady 14y ago
Q: If someone were to steal your HN password... whats the worst that could happen? A: Not much. It would seem extra security layers wouldn't provide much benefit.
- drcode 14y ago
  The only person who could get hurt is the one who uses the same password for HN as they do for their bank. Is it the responsibility of the website developer to protect that person from themselves?
  - erujolc 14y ago
    Not on HN unless you're retarded
  - corkill 14y ago
    Protect them from themselves no. Protect their password as much as possible when interacting with your web app/website I would say yes. I don't think about it as a responsibility rather just a nice or the right thing to do.
    - manuscreationis 14y ago
      I would definitely say it's the responsibility of the application developer to secure user account information, in addition to being the nice/right thing to do.
  - manuscreationis 14y ago
    Since you made the same comment more than once in this thread, I'll reply to you here as well. This attitude is absolutely not ok. You need to make sure the security of users accounts if a top priority, even if your app is 100% trivial in nature.
- manuscreationis 14y ago
  This is probably the worst possible response anyone could give with a question like this. I sincerely hope you're either joking, or in no way responsible for the security of user accounts wherever you happen to be employed.
yashchandra 14y ago
I think there is SSL but you have to manually change http to https in the login URL.